Turris Omnia

What Is Turris Omnia?

If you want to run a VPN at the router level (so every device on your network is covered) but you don’t want a black-box consumer router with abandoned firmware, you end up in a small market: gear that’s powerful, supported, and actually transparent about what it’s doing. Turris Omnia sits squarely in that lane.

It’s a paid, high-end router platform from the CZ.NIC association (the Czech “.cz” domain registry) with an OpenWrt-based operating system (Turris OS). Out of the box, it’s meant to be a real “gateway” device: firewalling, DNS, VPN, and optional add-ons like storage and LTE backup—without locking you into a vendor cloud. The UI story is also clearer than “here’s OpenWrt, good luck”: Turris OS ships with reForis/Foris for guided setup and LuCI for advanced configuration.

What makes Omnia distinctive isn’t one magic VPN feature; it’s the combination of (1) OpenWrt lineage and package ecosystem, (2) hardware that’s built to be configured and extended (including SFP and miniPCIe), and (3) an ecosystem focused on ongoing security updates and a collaborative security program (Turris Sentinel) you can opt into.

Turris Omnia Features and Performance

Start with the base: Omnia runs Turris OS, a Linux distribution based on OpenWrt, with Turris-maintained packages and components like reForis and an update system (“Updater-ng”). The official docs describe it as providing continuous updates, a user-friendly web interface, and integration with Turris Sentinel.

On the VPN front, you’re not dealing with a “VPN router” that only supports one vendor’s app. Because it’s OpenWrt-derived, you can install and configure standard VPN tech like OpenVPN and WireGuard. In third-party review coverage of the Omnia NG Wired, both OpenVPN and WireGuard are described as installable; that same review notes OpenVPN is easier to set up via the Turris interface while WireGuard may require going through OpenWrt tooling.
For real-world encrypted throughput, CZ.NIC’s own blog testing on Omnia reported close to ~700 Mbps using WireGuard in a benchmark that verified traffic went through the VPN. Treat this as a useful reference point—not a guarantee—because VPN throughput depends on cipher settings, clients, and how you test.

Hardware matters for VPN performance, and Omnia’s specs are firmly in “prosumer router” territory rather than cheap all-in-one Wi‑Fi hardware. OpenWrt’s device page and Turris datasheets list a Marvell Armada 385 dual-core CPU at 1.6 GHz, 2 GB RAM, and 8 GB eMMC storage (configurations vary by model/era; current datasheets and OpenWrt techdata commonly reference 2 GB RAM and 8 GB). These specs are enough to run router-level VPN for many home and small-office setups, but you should not expect “x86 firewall appliance” headroom if you plan to stack heavy DPI, IDS, and multiple tunnels.

Networking I/O is one of Omnia’s core strengths. OpenWrt techdata lists six 1GbE ports and one SFP port, plus VLAN support. The Wi‑Fi 6 datasheet for Omnia describes a 5× 1GbE LAN layout, a 1GbE RJ‑45 WAN plus an SFP WAN supporting up to 2.5 Gb (per that datasheet), and two USB 3.0 ports. That mix is unusually flexible for VPN-router use cases because SFP can matter in fiber setups (or when you want to interface with certain upstream gear). Turris’s own product page explicitly positions the SFP cage for FTTH scenarios and also mentions USB/miniPCIe LTE modem as backup connectivity.

Security features are not just “firewall on.” Turris OS is designed around frequent updates and optional participation in Turris Sentinel, which combines local detection (e.g., firewall logs and “minipots”/honeypots) with a dynamic firewall (“DynFW”) that can distribute attacker IP intelligence back to routers. The official docs describe Sentinel as threat detection and attack prevention; the dynamic firewall server is operated by the Turris team and publishes lists/updates of suspicious IPs, with a public snapshot (“greylist”) published daily. This is a genuine differentiator versus typical consumer routers, but it comes with an obvious privacy trade-off: to benefit from collective intelligence, the system may send security telemetry to Turris infrastructure (details depend on what components you enable and whether you agree to the Sentinel EULA).

One more practical “performance” angle: Turris Omnia is closer to a small Linux server than an appliance. Turris markets it for add-on roles like NAS and “home server,” enabled by USB 3.0 and the general OpenWrt package model. That’s great if you want one box to do more than routing, but it also means you’re the one responsible for not turning your router into an overworked, overexposed multitool.

Pricing and Plans

Turris Omnia is a paid hardware purchase, not a subscription VPN. You buy the router (and optionally upgrade kits/accessories), then run your VPN of choice on it.

Official Turris product pages present Omnia variants (Wi‑Fi 6, 4G, “No Wi‑Fi,” and references to a 5G kit), but the page content shown via web crawl isn’t a clean retail price list and appears to include at least one clearly incorrect number (“1 223 000 USD”) rather than a credible MSRP. Because of that, this review will not claim an official, current price.

In practice, pricing depends heavily on the exact model (classic Omnia vs newer Omnia NG variants), Wi‑Fi/LTE/5G configuration, and retailer. For example, a Czech retailer printout page lists “Turris Omnia NG Wired” at 9,902 Kč (Czech koruna) at the time of that listing. That’s retailer data, not a global MSRP, and it’s for the NG Wired model—not necessarily the Omnia configuration you’re considering.

There’s no “plan,” no monthly/annual tiers, and no subscription management implied by the product itself. Refunds/return windows are retailer-specific; if you care about returns, you must confirm the policy with the shop you buy from.

Privacy and Security Assessment

Jurisdiction and operator: Turris is developed by CZ.NIC (Czech Republic). That matters less like “VPN jurisdiction” (this is not a VPN provider) and more like: who runs update infrastructure, package repositories, and (optionally) Sentinel servers. Some network communication to Turris infrastructure is expected for updates and services.

Open-source posture: Multiple sources describe Omnia/Turris OS as open source. The OpenWrt device page describes Turris Omnia as an open-source router and notes the stock firmware is based on OpenWrt. LWN’s coverage states both hardware and software are free/open (in the context of the project’s goals and design). Turris OS documentation also states that Turris OS/OpenWrt software is open source and that source code is available, while noting some Wi‑Fi components (e.g., ath10k) require blobs. In plain terms: you get far more transparency than typical consumer routers, but it’s not “no blobs anywhere” if you use certain Wi‑Fi chipsets.

Updates: A core security claim of the Turris ecosystem is ongoing automatic updates. CZ.NIC annual reporting explicitly says their network devices can automatically update throughout their lifetime. This is one of the most important security features a router can have—most routers fail here.

Sentinel (dynamic firewall / telemetry trade-off): Sentinel is opt-in on non-Shield devices and requires installing packages and agreeing to an EULA; once enabled, data collected by Sentinel can be forwarded via a secure channel to Turris infrastructure, and routers can receive updated firewall rules. The Turris OS FAQ claims they collect data incoming from the Internet using minipots and firewall logs, and says outgoing data originated from a user is not disclosed “in general.” That’s a meaningful privacy claim, but it’s still data leaving your router, governed by an EULA, and controlled by toggles you must understand.

“Phone home” observations: Independent testing in a RouterSecurity.org review observed the Omnia making HTTPS connections to Turris infrastructure endpoints (including api.turris.cz and repo.turris.cz). That’s consistent with update checks and vendor services, not automatically evidence of privacy abuse—but it’s important if your threat model includes any vendor-controlled network traffic.

Audits and incidents: In the sources reviewed here, there is no clear third-party “no-logs audit” concept that applies the way it would for a VPN provider. Likewise, no major public security incident specific to Omnia is documented in the sources we relied on for this review. (If you need that level of assurance, you should treat routers like infrastructure and do your own monitoring.)

Strengths and Limitations

Strengths

• OpenWrt-based platform with real configurability. You get a proper Linux/OpenWrt environment (Turris OS) with both a guided UI (reForis/Foris) and a power-user UI (LuCI).
• Security update story is stronger than typical consumer routers. Automatic updates are a central design point in Turris documentation and CZ.NIC reporting.
• VPN flexibility (you choose the VPN). WireGuard and OpenVPN are both viable approaches on this platform; WireGuard performance on Omnia has been benchmarked by CZ.NIC staff at around the high hundreds of Mbps in at least one setup.
• Networking interfaces are unusually useful for advanced setups. Multiple 1GbE ports and SFP (and VLAN support) are a better match for real network segmentation than “one WAN, four LAN, hope for the best.”

Limitations

• This is not a plug-and-play “VPN appliance.” You’re operating in OpenWrt land. Even reviewers note WireGuard setup may require going through OpenWrt configuration rather than a simple vendor wizard.
• Sentinel is a privacy trade-off. It can improve attack prevention through collective intelligence, but it requires installing components and agreeing to an EULA, and involves sending selected security telemetry to Turris servers.
• Price and availability vary by model and retailer. Official pages don’t reliably present clean current pricing in the crawled content, so you should expect to shop around and verify what you’re actually buying.
• Not “no blobs” if you use certain Wi‑Fi hardware. Turris OS docs explicitly mention that some Wi‑Fi components require blobs.

Who Should Use Turris Omnia?

Good fit

1. You want router-level VPN without vendor lock-in. If you want to run WireGuard/OpenVPN at the gateway and pick your own VPN provider (or self-host), Omnia’s OpenWrt base is built for it.
2. You care about long-term patching and transparency. Automatic updates and open-source posture are recurring themes across Turris and CZ.NIC materials.
3. You actually use advanced networking features. VLANs, multiple Ethernet ports, and SFP support are meaningful if you segment home/IoT/work networks or integrate with fiber/ISP gear.

Not a great fit

1. You want a one-click consumer VPN router. If your expectation is “log into an app, press Connect,” this isn’t that.
2. You don’t want any vendor infrastructure connections. Updates and optional Sentinel participation mean your router may talk to Turris servers; if that’s unacceptable, you’ll be happier with a fully self-managed setup where you control update repos and telemetry.
3. You need guaranteed multi-gig VPN throughput. The available WireGuard benchmark shows strong performance in one test scenario, but it’s still an embedded ARM router. If you need consistently higher encrypted throughput under load, you’re likely looking at a more powerful router/firewall platform.